In a computer-based information system, devices (e.g., routers), operating systems (e.g., Linux and Windows operating systems), and applications (e.g., web and database servers) can generate significant amounts of log data. The data can be a basis from which operating information about the system can be retrieved.
Many existing tools (e.g., databases) can be used to analyze the data. These existing tools depend on the data having some structure. Unstructured data needs to be normalized for the operating information to be retrieved. To normalize data from different sources and having different formats can require a different normalization rule for each device, operating system, and application.